{"@ID": "927", "@Name": "Use of Implicit Intent for Sensitive Communication", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The Android application uses an implicit intent for transmitting sensitive data to other applications.", "Extended_Description": {"xhtml:p": ["Since an implicit intent does not specify a particular application to receive the data, any application can process the intent by using an Intent Filter for that intent. This can allow untrusted applications to obtain sensitive data. There are two variations on the standard broadcast intent, ordered and sticky.", "Ordered broadcast intents are delivered to a series of registered receivers in order of priority as declared by the Receivers. A malicious receiver can give itself a high priority and cause a denial of service by stopping the broadcast from propagating further down the chain. There is also the possibility of malicious data modification, as a receiver may also alter the data within the Intent before passing it on to the next receiver. The downstream components have no way of asserting that the data has not been altered earlier in the chain.", "Sticky broadcast intents remain accessible after the initial broadcast. An old sticky intent will be broadcast again to any new receivers that register for it in the future, greatly increasing the chances of information exposure over time. Also, sticky broadcasts cannot be protected by permissions that may apply to other kinds of intents.", "In addition, any broadcast intent may include a URI that references data that the receiving component does not normally have the privileges to access. The sender of the intent can include special privileges that grant the receiver read or write access to the specific URI included in the intent. A malicious receiver that intercepts this intent will also gain those privileges and be able to read or write the resource at the specified URI."]}, "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "285", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "668", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Mobile", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Architecture and Design"}}, "Common_Consequences": {"Consequence": [{"Scope": "Confidentiality", "Impact": "Read Application Data", "Note": "Other applications, possibly untrusted, can read the data that is offered through the Intent."}, {"Scope": "Integrity", "Impact": "Varies by Context", "Note": "The application may handle responses from untrusted applications on the device, which could cause it to perform unexpected or unauthorized actions."}]}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": {"Phase": "Implementation", "Description": "If the application only requires communication with its own components, then the destination is always known, and an explicit intent could be used."}}, "Demonstrative_Examples": {"Demonstrative_Example": [{"Intro_Text": "This application wants to create a user account in several trusted applications using one broadcast intent:", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null, null], "#text": "Intent intent = new Intent();intent.setAction(\"com.example.CreateUser\");intent.putExtra(\"Username\", uname_string);intent.putExtra(\"Password\", pw_string);sendBroadcast(intent);"}}, {"@Nature": "Attack", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "#text": "IntentFilter filter = new IntentFilter(\"com.example.CreateUser\");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);"}}], "Body_Text": ["This application assumes only the trusted applications will be listening for the action. A malicious application can register for this action and intercept the user's login information, as below:", "When a broadcast contains sensitive information, create an allowlist of applications that can receive the action using the application's manifest file, or programmatically send the intent to each individual intended receiver."]}, {"Intro_Text": "This application interfaces with a web service that requires a separate user login. It creates a sticky intent, so that future trusted applications that also use the web service will know who the current user is:", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null], "#text": "Intent intent = new Intent();intent.setAction(\"com.example.service.UserExists\");intent.putExtra(\"Username\", uname_string);sendStickyBroadcast(intent);"}}, {"@Nature": "Attack", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "#text": "IntentFilter filter = new IntentFilter(\"com.example.service.UserExists\");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);"}}], "Body_Text": "Sticky broadcasts can be read by any application at any time, and so should never contain sensitive information such as a username."}, {"Intro_Text": "This application is sending an ordered broadcast, asking other applications to open a URL:", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null], "#text": "Intent intent = new Intent();intent.setAction(\"com.example.OpenURL\");intent.putExtra(\"URL_TO_OPEN\", url_string);sendOrderedBroadcastAsUser(intent);"}}, {"@Nature": "Attack", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "String Url = intent.getStringExtra(Intent.URL_TO_OPEN);attackURL = \"www.example.com/attack?\" + Url;setResultData(attackURL);"}, "#text": "@Overridepublic void onReceive(Context context, Intent intent) {}"}, "#text": "public class CallReceiver extends BroadcastReceiver {}"}}], "Body_Text": ["Any application in the broadcast chain may alter the data within the intent. This malicious application is altering the URL to point to an attack site:", "The final receiving application will then open the attack URL. Where possible, send intents to specific trusted applications instead of using a broadcast chain."]}, {"@Demonstrative_Example_ID": "DX-108", "Intro_Text": "This application sends a special intent with a flag that allows the receiving application to read a data file for backup purposes.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null, null], "#text": "Intent intent = new Intent();intent.setAction(\"com.example.BackupUserData\");intent.setData(file_uri);intent.addFlags(FLAG_GRANT_READ_URI_PERMISSION);sendBroadcast(intent);"}}, {"@Nature": "Attack", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "Uri userData = intent.getData();stealUserData(userData);"}, "#text": "@Overridepublic void onReceive(Context context, Intent intent) {}"}, "#text": "public class CallReceiver extends BroadcastReceiver {}"}}], "Body_Text": "Any malicious application can register to receive this intent. Because of the FLAG_GRANT_READ_URI_PERMISSION included with the intent, the malicious receiver code can read the user's data."}]}, "Observed_Examples": {"Observed_Example": {"Reference": "CVE-2022-4903", "Description": "An Android application does not use FLAG_IMMUTABLE when creating a PendingIntent.", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-4903"}}, "References": {"Reference": [{"@External_Reference_ID": "REF-922", "@Section": "3.2.1"}, {"@External_Reference_ID": "REF-923"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2013-07-09", "Submission_Version": "2.5", "Submission_ReleaseDate": "2013-07-17"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-02-18", "Modification_Version": "2.6", "Modification_ReleaseDate": "2014-02-19", "Modification_Comment": "updated Demonstrative_Examples, Description, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Applicable_Platforms, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-03-15", "Modification_Version": "4.4", "Modification_ReleaseDate": "2021-03-15", "Modification_Comment": "updated Maintenance_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Detection_Factors, References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-10-26", "Modification_Version": "4.13", "Modification_ReleaseDate": "2023-10-26", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Weakness_Ordinalities"}]}}